CVE-2022-0220 — Improper Encoding or Escaping of Output

Vendor	Product	Version range	Fixed in
welaunch	wordpress_gdpr_ccpa	<= 1.9.26	—

GHSA

GHSA-7c99-6mgq-969f: The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1

ghsa_unreviewed·2022-02-02

CVE-2022-0220 [MEDIUM] CWE-116 GHSA-7c99-6mgq-969f: The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1 The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)

Red Hat

vim: heap-based buffer overflow in latin_ptr2len() at src/mbyte.c

vendor_redhat·2022-08-17·CVSS 7.8

CVE-2022-2849 [HIGH] CWE-122 vim: heap-based buffer overflow in latin_ptr2len() at src/mbyte.c vim: heap-based buffer overflow in latin_ptr2len() at src/mbyte.c Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. Statement: It is not possible to trigger a crash using this vulnerability as the vulnerable functions latin_ptr2len() do not have logic to return zero length when passed null values which is why this vulnerability has been rated as a low. Mitigation: Untrusted vim scripts with -s [scriptin] are not recommended to run. Package: vim (Red Hat Enterprise Linux 6) - Out of support scope Package: vim (Red Hat Enterprise Linux 7) - Out of support scope Package: vim (Red Hat Enterprise Linux 8) - Fix deferred Package: vim (Red Hat Enterprise Linux 9) - Fix deferred

Oracle

Oracle Oracle Fusion Middleware Risk Matrix: Web Listener (Apache HTTP Server) — CVE-2019-0220

vendor_oracle·2022-07-15·CVSS 5.3

CVE-2019-0220 [MEDIUM] Oracle Oracle Fusion Middleware Risk Matrix: Web Listener (Apache HTTP Server) — CVE-2019-0220 Oracle Oracle Fusion Middleware Risk Matrix: Web Listener (Apache HTTP Server) vulnerability CVE: CVE-2019-0220 CVSS: 5.3 Protocol: HTTP Remote exploit: Yes Affected versions: Network Advisory: cpujul2022 (JUL 2022)

CVE-2022-0220: The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users…

Affected

CVSS provenance